8e8e213d3be36b54778b1bd04b565225c50530b82dd57c6354922eb3e9cb7137 | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-05-2023 19:42

Sharing

Report Analysis Logs

General

Target

37ed820eefa1564fca7bd05f3648a85a.dll
Size

1.2MB
MD5

37ed820eefa1564fca7bd05f3648a85a
SHA1

d04ff080959018f266cb26280d733a1f5f6f931e
SHA256

8e8e213d3be36b54778b1bd04b565225c50530b82dd57c6354922eb3e9cb7137
SHA512

ec29095995243bc1e8b055893109f846ff5b3f749a6e1bffbdedfd041a90e22399424a1669c41eac1fb449bf36bc59d27f015cf2cd3554a8fd9fe39d3120dc5a
SSDEEP

24576:3FCcW8RT9F67gwL3k2UeOL9HnUUCexncTD+1z4IHN/Hp:PIr3jUeOfc3+TZJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	2032	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2044	2032	rundll32.exe	27
PID 2032 wrote to memory of 2044	2032	rundll32.exe	27
PID 2032 wrote to memory of 2044	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37ed820eefa1564fca7bd05f3648a85a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2032 -s 84
  2⤵
  - Program crash
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads